Privacy Policy

1. Introduction

Attesso B.V. (“Attesso,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website attesso.com(the “Site”), use our platform, or interact with our services (collectively, the “Services”).

Attesso B.V. is registered in the Netherlands under Chamber of Commerce number 42040136. We act as a data controller for Site, account, and business-contact data. When we process authorization data on a customer's behalf, our role may instead be that of a data processor under the customer's instructions.

2. Data We Collect

We collect the following categories of personal data:

• Account information: When you sign up via our authentication provider (Clerk), we process your name, email address, and authentication credentials. Your password is never accessible to us.
• Organization information: Company name, team member details, and role assignments within your organization.
• Contact form submissions: Name, email address, company name, and any information you provide in your message, processed via Formspree.
• Customer-support conversations: Messages and information you choose to provide through the Chatbase support agent. Signed-in users may be identified to the agent using their Attesso account identifier, name, and email address.
• Authorization service data: When you use our authorization services, we process mandate policies, customer references, passkey public-credential data, proposed-action attributes, authorization decisions, lifecycle events, and signed evidence. Customers must not submit card numbers, bank credentials, provider secrets, or other prohibited sensitive data to Attesso.
• API usage data: API key usage, request metadata, IP addresses, and activity logs for security and service-operation purposes.
• Technical data: IP address, browser type, operating system, referring URLs, and device information collected automatically when you visit our Site.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing and maintaining our Services
• Authenticating your identity and securing your account
• Managing mandates, approvals, authorization decisions, and evidence
• Communicating with you about your account and our Services
• Responding to your inquiries and support requests
• Detecting, preventing, and addressing fraud, abuse, and technical issues
• Complying with applicable legal obligations, including GDPR
• Improving and developing our Services

4. Cookies

Our Site uses the following types of cookies and browser storage:

• Essential cookies: Session and authentication cookies may be set by Clerk on sign-in and authenticated application routes to keep you signed in and secure your account. These are necessary for those account features.
• Optional customer-support storage: Chatbase may use cookies or browser storage to provide the support agent, retain conversation state, and associate signed-in support sessions with an account. Chatbase loads only after you accept the chat data-privacy prompt on a public marketing page.
• Analytics cookies: Google Analytics 4 cookies such as _ga help us understand how visitors use the Site. These are only enabled after you accept analytics cookies.

We do not use advertising or retargeting cookies. You can change your analytics choices at any time through Cookie Settings in the footer, and your chat choice by opening the chat widget. Rejecting essential storage may impair sign-in and authenticated account features.

5. How We Share Your Data

We share your data with the following service providers, each of which acts as a data processor on our behalf:

• Clerk, Inc.: User authentication and identity management.
• Cloud infrastructure providers: Application hosting, managed databases, content delivery, and service operation.
• Formspree, Inc.: Contact form submission handling.
• Chatbase: Customer-support agent and conversation handling, including authenticated-user identification when signed in.
• Google LLC: Website usage analytics, only after you accept analytics cookies.
• Vercel, Inc.: Website hosting, infrastructure, and content delivery.

We do not sell your personal data. We may disclose data when required by law or to protect our legal rights.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Account data is retained while your account is active. Authorization records and evidence are retained according to the applicable customer agreement, operational requirements, and legal obligations. You may request deletion of your account at any time by contacting us, subject to any required retention period.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. Approval uses WebAuthn passkeys with user verification. Depending on the customer's device, that verification may use a biometric or a device PIN. Attesso does not receive biometric data or the passkey's private key.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request that we correct inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing: You may request that we limit how we process your data.
• Right to data portability: You may request a copy of your data in a structured, machine-readable format.
• Right to object: You may object to the processing of your personal data for certain purposes.
• Right to withdraw consent: Where we rely on your consent to process data, you may withdraw it at any time.

To exercise any of these rights, contact us at info@attesso.com. We will respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. International Data Transfers

Our service providers may process data outside the European Economic Area (EEA), including in the United States. We ensure adequate protection for such transfers through Standard Contractual Clauses (SCCs) or other approved mechanisms as required by GDPR.

10. Children's Privacy

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on our Site. Continued use of our Services after changes take effect constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at: